ehlxr/docker_practice
1
0
Fork 0
mirror of https://github.com/yeasy/docker_practice.git synced 2026-08-10 16:37:34 +00:00
Code Issues Projects Releases Wiki Activity

fix(ci): fail closed on preview lookup errors

Browse Source
This commit is contained in:
yeasy
2026-07-10 19:29:30 -07:00
parent 8cd6094ae9
commit 397c66673b
2 changed files with 210 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/preview-pdf.yml
+44 -4
View File
@@ -90,6 +90,7 @@ jobs:
runs-on: ubuntu-latest
env:
GH_TOKEN: ${{ github.token }}
GH_REPO: ${{ github.repository }}
steps:
- name: Download verified preview bundle
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -113,33 +114,72 @@ jobs:
EOF
- name: Synchronize mutable preview tag
shell: bash
run: |
if gh api --silent "repos/${GITHUB_REPOSITORY}/git/ref/tags/preview-pdf" 2>/dev/null; then
set -euo pipefail
if [[ ! "$GITHUB_REPOSITORY" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then
echo "Invalid GITHUB_REPOSITORY: $GITHUB_REPOSITORY" >&2
exit 1
fi
if [[ ! "$GITHUB_SHA" =~ ^[0-9a-f]{40}$ ]]; then
echo "Invalid GITHUB_SHA" >&2
exit 1
fi
probe_dir=$(mktemp -d)
trap 'rm -rf "$probe_dir"' EXIT
set +e
gh api --include --method GET \
"repos/${GITHUB_REPOSITORY}/git/ref/tags/preview-pdf" \
>"$probe_dir/response" 2>"$probe_dir/error"
probe_rc=$?
set -e
http_status=$(awk '$1 ~ /^HTTP\// && $2 ~ /^[0-9][0-9][0-9]$/ { status=$2 } END { print status }' "$probe_dir/response")
if [[ $probe_rc -eq 0 && "$http_status" == "200" ]]; then
gh api --silent --method PATCH \
"repos/${GITHUB_REPOSITORY}/git/refs/tags/preview-pdf" \
--raw-field sha="$GITHUB_SHA" \
--field force=true
else
elif [[ $probe_rc -ne 0 && "$http_status" == "404" ]]; then
gh api --silent --method POST \
"repos/${GITHUB_REPOSITORY}/git/refs" \
--raw-field ref="refs/tags/preview-pdf" \
--raw-field sha="$GITHUB_SHA"
else
cat "$probe_dir/response" >&2
cat "$probe_dir/error" >&2
echo "Preview tag lookup failed (exit=$probe_rc, HTTP=${http_status:-unavailable}); refusing to mutate refs or releases." >&2
exit 1
fi
- name: Create or update preview release
shell: bash
run: |
if gh release view preview-pdf >/dev/null 2>&1; then
set -euo pipefail
error_file=$(mktemp)
trap 'rm -f "$error_file"' EXIT
set +e
gh release view preview-pdf >/dev/null 2>"$error_file"
release_rc=$?
set -e
if [[ $release_rc -eq 0 ]]; then
gh release edit preview-pdf \
--title "Latest Preview PDF" \
--notes-file dist/release-notes.md \
--prerelease
else
elif [[ "$(tr -d '\r' < "$error_file")" == "release not found" ]]; then
gh release create preview-pdf \
--title "Latest Preview PDF" \
--notes-file dist/release-notes.md \
--prerelease \
--latest=false \
--verify-tag
else
cat "$error_file" >&2
echo "Preview release lookup failed (exit=$release_rc); refusing to create or edit the release." >&2
exit 1
fi
- name: Replace preview assets